Privacy policy

Privacy Policy

6.1 Introduction

This Privacy Policy explains how Tailord India Private Limited (“Tail-Ord”, “we”, “us”) collects, uses, shares, stores and protects personal data when you use www.tail-ord.com, place an order, or otherwise interact with us.

We are the Data Fiduciary in respect of the personal data described here. You are the Data Principal.

This Policy is issued in accordance with the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, and with the Information Technology Act, 2000 and rules made under it.

6.2 Personal data we collect

You give us:

identity and contact details you provide at account creation or checkout — name, email address, phone number, delivery address and billing address;
order details — the Products selected, size, quantity, applied discounts, and your order history;
payment-related information you enter at checkout, to the extent shared with us by our payment gateway (we do not store your full card or banking credentials — see section 6.8);
information you choose to give us — communications with customer support, safety reports and claims, reviews, photographs and other User Content, and any measurements, preferences or notes you add to your account; and
information about your pet that you voluntarily share (for example, breed, size or name) for the purpose of product recommendations and support — see the note below.

Category	Examples	Why
Identity and contact	Name, email address, mobile number	Account creation, order processing, communication
Delivery	Shipping and billing address, pincode, alternate contact	Delivering your order
Order and transaction	Order history, invoices, returns, refunds, wallet balance	Fulfilment, accounting, tax, dispute handling
Payment	Payment method type, last four digits, transaction reference	Payment reconciliation. We do not store full card numbers, CVV, UPI PINs or net-banking credentials — these are handled by our PCI-DSS compliant payment gateway.
Pet profile	Pet name, breed, age, weight, measurements, coat type, sensitivities you tell us about	Size recommendation and product suitability. Optional.
Communications	Emails, chat, WhatsApp messages, call recordings, support tickets	Support, quality and dispute records
Content	Reviews, photographs, videos you submit	Publishing reviews, marketing where you consent
Preferences	Marketing consents, wishlist, saved items	Personalisation

We collect automatically: IP address, device and browser type, operating system, device identifiers, pages viewed, referring URL, session duration, clickstream, and cookie identifiers. See our Cookie Policy.

We receive from third parties: delivery status from logistics partners; payment status and risk signals from payment gateways; aggregated analytics and campaign data from advertising and analytics providers; and, where you use a social or Google login, the profile fields you authorise.

Information about your pet is not personal data about you under the DPDP Act as such, but we treat it with the same care because it is linked to your account.

6.3 Purposes for which we process personal data

creating and administering your account;
processing, fulfilling, delivering and invoicing your orders;
processing returns, refunds, cancellations and wallet credits;
providing customer support and handling grievances, safety reports and claims;
recommending sizes and Products, and personalising your experience;
sending transactional communications about your order (these are not marketing and cannot be opted out of while an order is live);
sending marketing communications where you have consented;
detecting, investigating and preventing fraud, returns abuse and security incidents;
product safety monitoring, batch traceability and recall;
analytics, service improvement, and testing;
complying with legal obligations, including under tax, GST, company, consumer protection and e-commerce law, and responding to lawful requests from authorities;
establishing, exercising or defending legal claims.

6.4 Legal basis

We process personal data on the basis of your consent, given through a clear affirmative action, and on the basis of certain legitimate uses recognised under section 7 of the DPDP Act, including where you voluntarily provide data for a specified purpose, for compliance with law, and for fulfilling a legal obligation.

Where processing rests on consent, that consent is free, specific, informed, unconditional and unambiguous, is sought through a standalone notice in plain language, and is limited to the data necessary for the stated purpose. You may withdraw consent at any time, as easily as you gave it — see section 6.10. Withdrawal does not affect processing carried out before withdrawal, and may mean we can no longer provide part of the service.

We do not use pre-ticked boxes, bundled consent, confirm-shaming, or any other design that nudges you into consenting. Consent to marketing is never a condition of purchase.

6.5 Sharing and disclosure

We share personal data only as follows, and only to the extent necessary:

Logistics and delivery partners — name, address, contact number, order details;
Payment gateways and financial institutions — transaction data;
Technology providers — website hosting, e-commerce platform, cloud storage, email and messaging, CRM, helpdesk, analytics;
Marketing and advertising providers — where you have consented;
Professional advisers — auditors, lawyers, insurers, on a need-to-know basis;
Authorities — where required by law, court order, or a lawful request, or to protect our rights, property or safety, or those of any person or animal;
In a corporate transaction — to a buyer or successor in a merger, acquisition, restructuring or sale of assets, subject to equivalent protection.

Every processor acting on our behalf is engaged under a written contract requiring them to process personal data only on our instructions, to apply reasonable security safeguards, and to delete or return the data at the end of the engagement. We do not sell personal data.

6.6 Cross-border transfer

Some of our service providers process data on servers outside India. We transfer personal data outside India only in accordance with section 16 of the DPDP Act and Rule 15 of the DPDP Rules, and not to any country or territory restricted by the Central Government. Where data is transferred, we ensure contractual and technical protections and remain accountable for it.

6.7 Retention and erasure

We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by law.

Data	Retention
Order, invoice and tax records	8 years under the Companies Act, 2013 and GST law
Account and profile data	While the account is active, and [X months] after closure
Support and grievance records	[X years]
Safety reports, defect and injury claims, batch records	[X years] — retained for product liability and recall purposes
Marketing consent records	For the duration of consent and [X years] after withdrawal, to evidence compliance
Cookie and analytics data	See Cookie Policy
Consent records and processing logs	[X years]

When the purpose is served and no legal obligation requires retention, we erase the personal data and require our processors to do the same.

6.8 Security

We implement reasonable security safeguards appropriate to the risk, including: encryption in transit (TLS); access control on a least-privilege basis; multi-factor authentication for administrator accounts; logging and monitoring of access; secure backups; vendor due diligence; staff confidentiality obligations and training; and periodic review.

No system is perfectly secure, and you are responsible for keeping your password confidential and for the security of the device you use.

6.9 Personal data breach

If a personal data breach occurs, we will notify each affected Data Principal without delay, in plain language, describing the nature and likely consequences of the breach, the measures we have taken, and what you can do; and we will notify the Data Protection Board of India within the timelines and in the manner prescribed under the DPDP Rules, 2025.

6.10 Your rights

Under the DPDP Act you have the right to:

Access a summary of the personal data we process about you, the processing activities, and the identities of the Data Fiduciaries and processors with whom it has been shared;
Correction, completion, updating and erasure of your personal data;
Grievance redressal in respect of any act or omission by us regarding your data;
Nominate another individual to exercise your rights in the event of your death or incapacity;
Withdraw consent at any time.

How to exercise them: write to our Data Protection Contact at hello@tail-ord.com, or use the tools in your account. We may ask you to verify your identity, using the credentials associated with your account. We will respond within 10 business days.

You may complain to the Data Protection Board of India if you are not satisfied with our response.

Duties of a Data Principal. The DPDP Act requires you not to impersonate another person, not to suppress material information, not to register a false or frivolous grievance, and to furnish only authentic information when seeking correction or erasure.

6.11 Marketing communications

We send marketing emails, SMS and WhatsApp messages only where you have opted in. Every message contains an unsubscribe or opt-out mechanism. Withdrawal is processed within 2 business days. Transactional messages about a live order continue regardless.

Our telemarketing and commercial communications comply with applicable TRAI regulations.

6.12 Children

Our Platform is intended for adults. We do not knowingly collect personal data of a child under 18 years of age.

Where we process the personal data of a child or of a person with a disability who has a lawful guardian, we will obtain verifiable consent from the parent or lawful guardian in the manner required by the DPDP Act and Rules. We will not undertake tracking or behavioural monitoring of children, or direct advertising at children.

If you believe a child has provided us with personal data, contact us and we will delete it.

6.13 Automated processing

We use automated processing for size recommendation, product recommendation and fraud screening.

6.14 Changes to this Policy

We may update this Policy. Where a change is material, we will notify you by email and, where the change requires it, seek fresh consent.

6.15 Contact

Data Protection Contact: Ms. Vaishnavi Reddy, hello@tail-ord.com, +91 9959962532
Postal: Tailord India Private Limited, 13/385, Main Road, Ambalavanapuram, Ambasamudram, Tirunelveli, Tamil Nadu 627425